Completely redo backups

flake.lock

@@ -406,11 +406,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1705856552,
+        "lastModified": 1707092692,
-        "narHash": "sha256-JXfnuEf5Yd6bhMs/uvM67/joxYKoysyE3M2k6T3eWbg=",
+        "narHash": "sha256-ZbHsm+mGk/izkWtT4xwwqz38fdlwu7nUUKXTOmm4SyE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "612f97239e2cc474c13c9dafa0df378058c5ad8d",
+        "rev": "faf912b086576fd1a15fca610166c98d47bc667e",
         "type": "github"
       },
       "original": {

hosts/myself/container-git.nix

@@ -8,6 +8,7 @@ in {
 		inputs.agenix.nixosModules.default
 		../../modules/linux/proxy.nix
 		../../modules/linux/tailscale.nix
+		../../modules/linux/backup.nix
 	];
 
 	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
@@ -42,6 +43,19 @@ in {
 
 	virtualisation.docker.enable = true;
 
+	programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
+		"Host nas"
+		"    User backup"
+		"    IdentityFile /etc/ssh/duplicity_ed25519"
+		"    StrictHostKeyChecking no"
+		"    UserKnownHostsFile /dev/null"
+	];
+
+	greg.backup.jobs.nas-backup = {
+		src = "/var/gitlab/state/backup/";
+		dest = "gitlab";
+	};
+
 	services = {
 		gitlab = {
 			enable = true;

modules/linux/backup.nix

@@ -2,46 +2,24 @@
 
 let
 	cfg = config.greg.backup;
-	backup_key = "backup_keys/id_ed25519";
 
-	makeJob = name: job: {
+	makeTimer = name: job: {
-		paths = job.src;
+		timerConfig.OnCalendar = "daily";
-		encryption.mode = "none";
+		wantedBy = [ "timers.target" ];
-		environment.BORG_RSH = "ssh -i /etc/${backup_key} -o 'StrictHostKeyChecking=no' -o 'UserKnownHostsFile=/dev/null'";
-		repo = "ssh://backup@nas.me.ts//volume1/NetBackup/${job.dest}";
-		compression = "auto,zstd";
-		startAt = "daily";
-
-		user = job.user;
-		group = job.group;
-		preHook = job.pre;
-		postHook = job.post;
 	};
 
-	cronJob = name: job:
+	makeService = name: job: {
-	let
+		serviceConfig = {
-		binName = "backup-${name}";
+			User = job.user;
-		script = pkgs.writeShellScriptBin binName ''
+			ExecPre = lib.optionalString (job.pre != "") job.pre;
-exec 1> >(systemd-cat -t $(basename $0)) 2>&1
+			ExecStart = "${pkgs.rsync}/bin/rsync -avz --delete -e '${pkgs.openssh}/bin/ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null' ${job.src}/ backup@nas:/volume1/NetBackup/${job.dest}";
-set -ex
+			ExecPost = lib.optionalString (job.post != "") job.post;
-${job.pre}
+		};
-${pkgs.rsync}/bin/rsync -avz --delete -e "${pkgs.openssh}/bin/ssh -i /etc/${backup_key} -o 'StrictHostKeyChecking=no' -o 'UserKnownHostsFile=/dev/null'" ${job.src}/* backup@chronicles:/volume1/NetBackup/${job.dest}/
-${job.post}
-'';
-	in {
-		inherit script;
-		cron = "0 1 * * * ${job.user} ${script}/bin/${binName}";
 	};
 
 in with lib; {
 	options = {
 		greg.backup = {
-			key = mkOption {
-				type = types.path;
-				description = "SSH key to use";
-				default = ../ssh/id_ed25519;
-			};
-
 			jobs = mkOption {
 				default = {};
 
@@ -82,15 +60,11 @@ in with lib; {
 		};
 	};
 
-	config = let
+	config = mkIf ( ( attrValues cfg.jobs ) != [] )
-		jobs = attrValues ( mapAttrs cronJob cfg.jobs );
-	in mkIf ( ( attrValues cfg.jobs ) != [] )
 	{
-		services.cron = {
+		systemd = {
-			enable = true;
+			timers = mapAttrs makeTimer cfg.jobs;
-			systemCronJobs = map (e: e.cron) jobs;
+			services = mapAttrs makeService cfg.jobs;
 		};
-
-		environment.systemPackages = map (e: e.script) jobs;
 	};
 }